TechKnowSurge
TechKnowSurge Catalog Videos Intrusion Detection and Pervention Systems (IDS/IPS)
VideoSecurityFree

Intrusion Detection and Pervention Systems (IDS/IPS)

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are security tools that monitor network traffic for signs of unauthorized access, with IDS alerting administrators to threats and IPS automatically taking action to stop them.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Strong perimeter security reduces risk, but it does not eliminate the possibility of network intrusion. Unpatched vulnerabilities, social engineering attacks, and misconfigured access controls can all allow adversaries to bypass firewalls entirely, which is why dedicated detection and prevention capabilities are a critical layer in any defense-in-depth strategy. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) fill this role by continuously analyzing network traffic for indicators of malicious activity, using regularly updated signature databases that capture known attack patterns, behaviors, and packet characteristics associated with specific threats and threat actors. The core distinction between IDS and IPS lies in how each responds to a detected threat. An IDS is a passive monitoring system that identifies suspicious activity and generates alerts, requiring a human administrator to investigate and take corrective action, such as updating firewall rules to block the offending traffic. An IPS goes a step further by automatically implementing countermeasures the moment a threat is detected, without waiting for human response. In most modern implementations, IDS and IPS are not distinct products but configurable options within a single system, often integrated directly into enterprise firewalls, where administrators can choose whether the system should alert only or alert and respond. Each approach involves trade-offs. IPS provides faster response times and reduces the window of exposure, but its automatic blocking behavior can cause performance degradation under heavy traffic loads and risks disrupting legitimate traffic through false positives. IDS avoids those risks but leaves the network exposed during the time it takes an administrator to act on an alert. Deployment architecture is another key consideration. Network-based IDS/IPS solutions monitor traffic across the entire network from a central vantage point, while host-based solutions install agents on individual endpoints for more granular visibility into system-level activity. Because each approach has distinct blind spots, many organizations deploy both in combination to achieve comprehensive coverage across their environment.

What you'll learn

What's covered

Intrusion Detection & Prevention

Key terms

Intrusion Detection System
IDS
A system that monitors network or system activities for malicious behavior and generates alerts.
Intrusion Prevention System
IPS
A system that monitors network traffic and actively blocks detected threats in real time.
Host-based Intrusion Detection System
HIDS
A security system that monitors and analyzes activity on a single host for signs of malicious behavior.
Signature-based Detection
A detection method that identifies threats by comparing network traffic or system activity against a database of known attack patterns and fingerprints.
Network-based IDS/IPS
An IDS or IPS deployment that monitors traffic across the network as a whole rather than on individual hosts.

Topics

Intrusion Detection Systems Intrusion Prevention Systems Signature Based Detection Network Security Network Traffic Analysis Host Based Security

Transcript

Why We Need Intrusion Detection

Just because we set up firewalls and a great perimeter around our systems doesn't mean that adversaries can't get into our network. So we need some sort of methodology, some sort of way of telling if there has been an intrusion on our network. That's what intrusion detection and intrusion prevention systems do.

Unfortunately, intrusions are quite common on networks. Maybe somebody forgot to update the firewall and now an adversary took advantage of some vulnerability that didn't get patched and is in the system. Or maybe they did some sort of social engineering to gain access through one of the devices on the network. Whatever the case may be, we need some sort of way to recognize when there's an intrusion.

Intrusion Detection Systems

An intrusion detection system does just as the name suggests: it detects when there's an intrusion on the network. There are a few ways we can set this up. For instance, we can plug it into the switch and it can monitor the traffic that's going across that switch -- maybe we're duplicating all the data to see what's happening on it. That's one way to set it up. Or we could set it up on the front end, so as traffic comes into this network we can analyze it, or maybe as it's going out of the network. Whatever the case may be, it's looking for suspicious traffic.

The key to an intrusion detection system is detection. It's looking for whether there's an intrusion on the network, and if it finds it, it will do some sort of alerting. Either you have to check the box -- maybe it's some sort of dashboard that you pull up -- or it's probably going to send you some sort of email and let you know something is happening on your network and it detected it.

If there's an intrusion on your network and it's been detected and you've been warned about it, now you have to manually take action. You have to go to the firewall and maybe create a new rule that blocks that adversary from continually accessing your network, or take some sort of action in order to fix the problem.

Intrusion Prevention Systems

The other way we could go about doing this is to implement an intrusion prevention system, which will actually take steps to fix the issue. It's really just an intrusion detection system, but rather than warning you, it takes the extra step and actually just takes care of it.

An example of this is we've got a machine right here, and maybe this is set up with an IPS, an intrusion protection system. Now when somebody has intruded onto your network, it recognizes that and takes automatic steps to block it. Maybe it sets up a rule automatically to block that, or maybe it does it at the intrusion prevention system. Whatever the case may be, it takes steps to fix the issue.

Comparing IDS and IPS

Here's the difference between IDS and IPS. An intrusion detection system is just for detecting, versus a prevention system will actually stop the attack from happening.

The problem is that this can have a performance hit on the traffic that's going back and forth, and it could accidentally block something that is legitimate, and you don't have time to respond because it all happens automatically. Versus the IDS, which can't stop those attacks, but it does reduce the chances or the impact if there's a false positive. That is, if it identifies that there's an intrusion and stops it, but it actually was legitimate traffic, that could be very impactful.

The other thing that happens is that if the IDS gets overloaded and just tries to keep up, it's not going to stop communication from happening. Versus the intrusion prevention system, which can end up doing that: if you overload the system, then it could end up possibly blocking some of that traffic.

Now, IDSs and IPSs are pretty much the same thing, except that an IPS really just takes action on it. So it's really the same system. When you see these systems, you'll see IDS/IPS, because it's really just a check box of, okay, do you want to take that extra step and block it after that, and whether you do or don't. If you uncheck that box, then what it's going to do is just detect and warn you. If you check that box, now it's actually going to take action. So really an IDS and an IPS are not separate systems -- it's just a selection that you have on there.

IDSs and IPSs can be their own systems that you implement, but a lot of times now we have it on the firewall. They're built into the firewall, and so the firewall will do this if you set it up to do that. Most of the time you're going to be working with your firewall for these IDS/IPS solutions.

How They Work

How do they work? They use signatures, fingerprints, trends. What happens essentially is that they will download updates on what to look for, and then they'll start looking for those.

Think of it as a fingerprint. If there's a fingerprint at a crime scene, it'll identify something that's happened. There are fingerprints when it comes to adversaries and attacks. Certain adversaries have certain patterns. They have certain tools that they'll use. Packets that are coming in and out of the system will look different. So based off of these patterns, they'll create signatures, and then the intrusion detection system / intrusion prevention system will download these signatures and start looking for them on your network.

Network-Based Versus Host-Based

We can also implement these on a network side or on a host side. If it's on the host side, then it's just on each individual host. And every host -- if you have Linux and Windows and Macs, you'll have to have a separate agent, a separate way of doing that for each one of those systems -- and it only is protecting those systems. Versus if you have network-based, it's looking at the network overall, but might not get as granular as these host-based systems. So many times we'd actually implement both network-based and host-based systems, so we've got all of our bases covered.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →